testing

modules/options.nix

@@ -9,6 +9,41 @@
 # the option exists. `modules/essentials/ssh.nix` does not belong here: it
 # declares and reads `host.ssh.enable` itself, within one module.
 {
+  # Remote-builder wiring. A coordinator (e.g. sapphira) sets
+  # `host.builder.clients` to register remote build machines;
+  # a builder host (e.g. the WSL on vetymae) sets `host.builder.enable`
+  # to advertise itself. The two halves are intentionally split so a single
+  # declaration in configurations/* is enough to flip each side.
+  options.host.builder = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Advertise this host as a remote Nix builder and accept builds
+        from other machines in the flake over SSH.
+      '';
+    };
+    clients = lib.mkOption {
+      type = lib.types.listOf lib.types.attrs;
+      default = [ ];
+      description = ''
+        List of remote Nix build machines this coordinator should
+        register via `nix.buildMachines`. Each entry matches the NixOS
+        option schema (hostName, sshUser, sshKey, systems,
+        supportedFeatures, ...). Two extra attributes are consumed by
+        modules/server/builder.nix and stripped before reaching
+        `nix.buildMachines`:
+          - `proxyCommand` — generates a per-builder Host block in the
+            system-wide OpenSSH config (the nix-daemon runs as root and
+            cannot see the user's ~/.ssh/config).
+          - `hostKeyAlias` — alias used inside that SSH matchBlock.
+        A builder reachable on its own (no ProxyCommand needed) omits
+        both and gets no SSH matchBlock. Empty by default — opt in by
+        setting this list.
+      '';
+    };
+  };
+
   options.host."3x-ui" = {
     # Domain whose Let's Encrypt cert (at /var/lib/acme/<domain>/)
     # gets mounted read-only into the 3x-ui container so the panel